Then they say in A.1 that it is possible to get "not only" 23 bi-affine but 39 fully quadratic equations.
And they further describe that the additional 16 equations come from a) $x^4y = x^3$ and b) $y^4x = y^3$.
($y = x^{-1}$ is the result of the inversion in the sbox)

I assume they produce these 16 equations in the very same way how they generated the 23 bi-affine equations (which is described here providing more details):

They transform/rearrange the equations a) and b) to have 0 on one side.

Then they "split" each equation a) and b) in 8 equations for each coefficient, so we have 16 equations in total for both a) and b).

I would assume that every exponent $\neq 0$ of any $x_i$ and $z_i$ can be ignored because those variables representent coefficients in $GF(2)$ and can be either $0$ or $1$. *

So when I ignore the exponents this looks very similar to the bi-affine equations (a sum of combinations of $x_i$ and $y_i$, sometimes with terms of only $x_i$ or $y_i$ - the only thing which is new is that there are terms of $x_i$ and $x_j$ multiplied together) and I would like to understand the difference!

So how are these equations "fully quadratic" and what does it mean exactly? What is the difference to the bi-affine equations besides the number of the equations?

*: This was also necessary in the process of generating the 23 bi-affine equations, where the equation $x^{128} = y^{128} x$ was used. This led to $x_i^{128}$ in the result which to my understanding can also be shortened to $x_i$.

1 Answer
1

Looking at appendix A of the eprint I'd say that the authors call a polynomial of algebraic degree at most $2$ bi-affine, if it contains some terms of algebraic degree $1$, and fully quadratic, if there are no such terms.

(Working over fields of characteristic $2$ the map $x\mapsto x^2$ is linear over the field with two elements and of algebraic degree $1$.)

$\begingroup$Thank you, this makes sense to me. But when I calculate all the 16 "fully quadratic" equations in GF(2) like mentioned above, I also find a constant term in the very last equation - so it still confuses me.$\endgroup$
– magic_bitMar 11 '19 at 10:06